GDPR fines for websites: what regulators actually enforce

In this article

Most of what website owners hear about GDPR enforcement comes from headlines about nine-figure fines against the largest technology companies. Those cases are real, but they say little about the risk facing a typical company website or online shop. The enforcement that reaches ordinary sites usually starts with a complaint, ends with an order to fix something, and turns on evidence the site owner could have produced in advance.

01The ceiling, not the norm

Article 83 GDPR sets two maximums. Infringements of, among others, the obligations of controllers and processors can be fined up to €10 million or 2% of total worldwide annual turnover of the preceding financial year, whichever is higher (Article 83(4)). Infringements of the basic principles, including the conditions for consent, of data subjects' rights and of the rules on international transfers can be fined up to €20 million or 4% (Article 83(5)).

These are ceilings. Article 83(2) requires authorities to consider, case by case, the nature, gravity and duration of the infringement, whether it was intentional or negligent, what was done to mitigate the damage, the degree of cooperation, previous infringements and the categories of data affected. The EDPB’s Guidelines 04/2022 on the calculation of fines set out a common method, in which the size of the undertaking is one of the starting points. Fines must be effective, proportionate and dissuasive, which for a small business means something very different from what it means for a global platform.

02Two legal tracks: the GDPR and national cookie law

For websites, the largest fines so far have not been GDPR fines at all. Cookies and similar technologies are governed by the national laws implementing Article 5(3) of the ePrivacy Directive. These laws are enforced by national authorities, and, as the EDPB explained in its Opinion 5/2019 on the interplay between the ePrivacy Directive and the GDPR, the GDPR’s one-stop-shop mechanism does not apply to them.

France’s CNIL has used this route repeatedly. On 7 December 2020 it fined Google LLC and Google Ireland Limited a total of €100 million, and Amazon Europe Core €35 million, for placing advertising cookies without prior consent and without adequate information. On 31 December 2021 it fined Google a total of €150 million and Facebook Ireland €60 million because refusing cookies was harder than accepting them. In January 2022 the Conseil d’État, France’s highest administrative court, upheld the 2020 Google sanction and confirmed that the CNIL was competent to act outside the one-stop-shop mechanism.

For a site owner the practical consequence is that an authority in any country where the site is used can act on its cookies, regardless of where the company is established in the EU.

03What authorities act on most often

Across published decisions and authority guidance, the issues that recur for websites are consistent:

• Cookies before consent and banners that make refusal harder than acceptance (see consent banner designs regulators object to).
• Missing or incomplete privacy notices. Articles 12 to 14 GDPR require concise, transparent information about who processes data, for what purposes, on what legal basis, for how long and with whom it is shared.
• No valid legal basis for processing, for example newsletter sign-ups used for unrelated marketing.
• Data subject requests ignored. Access, erasure and objection requests must be answered, normally within one month (Article 12(3)).
• Security failures in contact forms, logins and customer accounts (Article 32), often discovered through a breach that must be notified to the authority (Article 33).
• International transfers through embedded third-party tools. After the Court of Justice invalidated the EU-US Privacy Shield in Schrems II (Case C-311/18, 2020), several authorities found, in decisions published from early 2022, that particular uses of Google Analytics led to unlawful transfers. The European Commission’s adequacy decision for the EU-US Data Privacy Framework of 10 July 2023 changed that analysis for transfers to certified US companies.

04How a case usually starts

Few website cases start with an authority’s own investigation. The usual trigger is a complaint under Article 77 GDPR, often from a visitor whose access request went unanswered or who noticed tracking after refusing it. Organised complaint campaigns, such as those by noyb about cookie banners in 2021, can bring many sites to an authority’s attention at once. Authorities also run sector sweeps and act on breach notifications.

A complaint is usually followed by a letter asking for an explanation. What you can show at that point (your records, your consent configuration, your scan reports, your replies to the data subject) shapes everything that follows.

05What usually happens instead of a fine

Article 58(2) GDPR gives authorities a range of corrective powers: warnings, reprimands, orders to comply with a data subject’s request, orders to bring processing into compliance within a set period, temporary or definitive limits on processing, and fines, which can be imposed in addition to or instead of the other measures. For small organisations and first infringements, a reprimand and an order to fix the problem within a deadline are common outcomes. Failing to comply with such an order is itself an infringement that can be fined (Article 83(6)).

06Private enforcement: damages and competitors

Authorities are not the only route. Under Article 82 GDPR anyone who suffers material or non-material damage from an infringement can claim compensation. In Österreichische Post (Case C-300/21, 2023) the Court of Justice held that a mere infringement does not by itself give rise to compensation, the person must show damage, but that there is no threshold of seriousness for non-material damage. In January 2022 the Regional Court of Munich awarded a visitor €100 because a website passed his IP address to Google by loading Google Fonts from Google’s servers without consent; the judgment prompted a wave of demand letters in Germany.

In Lindenapotheke (Case C-21/23, 4 October 2024) the Court of Justice confirmed that national law may allow competitors to sue over GDPR infringements as unfair commercial practices. And the Representative Actions Directive ((EU) 2020/1828) lists the GDPR among the laws for which qualified entities can bring collective actions on behalf of consumers.

07Reading the risk for your own site

The pattern across these routes is that outcomes depend heavily on what the site owner can demonstrate. Article 5(2) GDPR makes the controller responsible for, and able to demonstrate, compliance. In practice that means keeping:

• a current privacy notice and cookie notice that match what the site actually does;
• a record of the consent configuration and of consent given, where you rely on consent;
• dated scan reports showing what loads before and after consent, and what you fixed;
• contracts with processors such as hosting, email and analytics providers (Article 28);
• a log of data subject requests and how you answered them.

None of this requires a large budget. It requires doing the checks regularly and keeping the results, which is also where the automated tools we review and rank are most useful.

08Sources and further reading

Primary legal texts and official guidance referred to above. Links go to the official publishers.

1. Regulation (EU) 2016/679 (GDPR) (eur-lex.europa.eu)
2. EDPB Guidelines 04/2022 on the calculation of administrative fines (edpb.europa.eu)
3. EDPB Opinion 5/2019 on the interplay between the ePrivacy Directive and the GDPR (edpb.europa.eu)
4. CNIL: the Conseil d’État confirms the 2020 cookie sanction against Google (cnil.fr)
5. Court of Justice of the EU, Case C-311/18 Schrems II (curia.europa.eu)
6. Commission Implementing Decision (EU) 2023/1795 (EU-US Data Privacy Framework) (eur-lex.europa.eu)
7. Court of Justice of the EU, Case C-300/21 Österreichische Post (curia.europa.eu)
8. Court of Justice of the EU, Case C-21/23 Lindenapotheke (curia.europa.eu)
9. Directive (EU) 2020/1828 (Representative Actions Directive) (eur-lex.europa.eu)